@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/app-host/setup-engine.js

@@ -0,0 +1,73 @@
+/** Stateless collection setup planning over an inventory the caller read
+ * through its own client session (a Private collection over the relay). The
+ * same native engine and review digest as a hosted collection's setup; no
+ * runtime open, session, SQL or write. The planned writes are guarded, and
+ * the collection's own replica enforces them when the caller submits. */
+import { decode, encode } from "../cbor.js";
+import { mdbaseError } from "../errors.js";
+import { WasmRuntime } from "../runtime/wasm.js";
+import { resourceAssessment, resourceDecisions } from "./collection-control.js";
+import { modelResourcePlan } from "./collection-setup-journal.js";
+import { resourceJson } from "./wasm-runtime.js";
+const OUTPUT_MAX = 512 * 1024, INPUT_MAX = 512 * 1024 + 8_388_608 + 16 * 4096;
+const unsupported = () => mdbaseError("unavailable", "resource setup unsupported", "resource_setup_unsupported");
+const unavailable = () => mdbaseError("unavailable", "resource setup unavailable", "resource_setup_unavailable");
+export class AppSetupEngine extends WasmRuntime {
+    native;
+    constructor(native) {
+        super(native);
+        this.native = native;
+    }
+    static async create(bytes) {
+        const x = await this.load(bytes);
+        if (!(x.memory instanceof WebAssembly.Memory) || typeof x.rt_app_setup_assess !== "function")
+            throw unsupported();
+        return new AppSetupEngine(x);
+    }
+    /** Passing decisions (even `{}`) asks for the review. */
+    assess(manifest, inventory, decisions) {
+        return resourceAssessment(this.call(false, manifest, null, inventory, decisions), decisions !== undefined);
+    }
+    plan(manifest, expected, inventory, decisions) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(expected))
+            throw mdbaseError("invalid_request", "invalid assessment digest");
+        return modelResourcePlan(this.call(true, manifest, expected, inventory, decisions));
+    }
+    call(apply, manifest, expected, inventory, decisions) {
+        const request = [1, apply ? 1 : 0, resourceJson(manifest, true), expected,
+            inventory.map(([path, source]) => [path, source])];
+        if (decisions !== undefined)
+            request.push(resourceJson(resourceDecisions(decisions), true));
+        const input = encode(request);
+        if (input.length > INPUT_MAX) {
+            input.fill(0);
+            throw mdbaseError("invalid_request", "resource DATA exceeds bound");
+        }
+        let output;
+        try {
+            const native = this.native.rt_app_setup_assess;
+            try {
+                const packed = BigInt.asUintN(64, native.call(this.x, ...this.put(input)));
+                const length = Number(packed & 0xffffffffn);
+                if (!length || length > OUTPUT_MAX)
+                    throw unavailable();
+                output = this.takeOut(packed);
+            }
+            catch (error) {
+                this.discard();
+                throw error;
+            }
+            const response = decode(output);
+            if (!Array.isArray(response) || response.length !== 3 || response[0] !== 1 || typeof response[1] !== "boolean")
+                throw unavailable();
+            if (response[1] === false)
+                throw unavailable();
+            return resourceJson(response[2], false);
+        }
+        finally {
+            input.fill(0);
+            output?.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=setup-engine.js.map

package/dist/app-host/setup-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-engine.js","sourceRoot":"","sources":["../../src/app-host/setup-engine.ts"],"names":[],"mappings":"AAAA;;;;yEAIyE;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAyD,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKjD,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,EAAE,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9E,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;AACjH,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;AAEjH,MAAM,OAAO,cAAe,SAAQ,WAAW;IACR;IAArC,YAAqC,MAAoB;QAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAAtC,WAAM,GAAN,MAAM,CAAc;IAAmB,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAmB;QACrC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAiB,CAAC;QACjD,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,WAAW,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,KAAK,UAAU;YAAE,MAAM,WAAW,EAAE,CAAC;QAClH,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,yDAAyD;IACzD,MAAM,CAAC,QAAiB,EAAE,SAA4B,EAAE,SAAgC;QACtF,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,QAAiB,EAAE,QAAgB,EAAE,SAA4B,EAAE,SAAgC;QACtG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,WAAW,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC/G,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACtF,CAAC;IACO,IAAI,CAAC,KAAc,EAAE,QAAiB,EAAE,QAAuB,EAAE,SAA4B,EAAE,SAAgC;QACrI,MAAM,OAAO,GAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAc,EAAE,QAAQ;YACjG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAc,CAAC,CAAC;QACzG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,WAAW,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QAAC,CAAC;QACrH,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAoB,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;gBAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,GAAG,UAAU;oBAAE,MAAM,WAAW,EAAE,CAAC;gBACxD,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM,WAAW,EAAE,CAAC;YACpI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK;gBAAE,MAAM,WAAW,EAAE,CAAC;YAC/C,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/app-host/sign-out-erase.d.ts

@@ -0,0 +1,37 @@
+export interface AppSignOutEraseScope {
+    readonly cpOrigin: string;
+    readonly appId: string;
+    /** Local slot owner (installation-store `owner`); absent for unlabelled slots. */
+    readonly owner?: string;
+    readonly storageNamespace?: string;
+    /** Null when the ledger never reached that step (no account confirmed yet). */
+    readonly accountId: string | null;
+    readonly connectorId: string | null;
+    readonly installationId: string | null;
+    readonly deviceId: string | null;
+    /** Collections this installation knew (approved or listed). */
+    readonly collectionIds: readonly string[];
+    /** App-scoped databases its collections use (join ledger, setup journal). */
+    readonly databases: readonly string[];
+    /** Fresh single-collection recovery actors cannot erase an earlier/global
+     * slot, shared journals or other installations' token cache. */
+    readonly isolated?: boolean;
+}
+export interface AppSignOutEraseResult {
+    /** The installation ledger is gone: a reload starts signed out. */
+    readonly ledger: boolean;
+    /** Every other store was removed too. False leaves a leftover (a store in
+     * use or a browser refusal); it is a diagnostic, never a reason to stay signed in. */
+    readonly complete: boolean;
+}
+/** Bound for each deletion. A blocked IndexedDB delete stays queued in the
+ * browser and completes when the last connection closes; sign-out only stops
+ * waiting for it and reports it as incomplete. */
+export declare const SIGN_OUT_ERASE_TIMEOUT_MS = 5000;
+/** Forget one retired hosted scope's replica keys/data and bootstrap outcomes.
+ * The original installation signing custody, other scopes, shared journals and
+ * token cache remain untouched. Call only after that scope's native/SQL stop. */
+export declare function eraseAppCollectionAccess(scope: AppSignOutEraseScope, collectionId: string): Promise<boolean>;
+/** Run only after every connection/handle of this installation was closed and
+ * the server sign-out was attempted. Never throws. */
+export declare function eraseAppInstallationData(scope: AppSignOutEraseScope): Promise<AppSignOutEraseResult>;

package/dist/app-host/sign-out-erase.js

@@ -0,0 +1,139 @@
+/** UX-011 sign-out erasure: this browser's local data for ONE installation of
+ * one app. Every name is derived from the known scope (CP origin, local slot
+ * owner, appId, account, connector, device, installation, collections), the
+ * same derivations the stores use; nothing outside that scope is touched. */
+import { LOG_TOKEN_DATABASE, eraseAppLogTokens } from "./log-token-cache.js";
+import { uuidToBytes } from "../codec.js";
+/** Bound for each deletion. A blocked IndexedDB delete stays queued in the
+ * browser and completes when the last connection closes; sign-out only stops
+ * waiting for it and reports it as incomplete. */
+export const SIGN_OUT_ERASE_TIMEOUT_MS = 5_000;
+const hex = (id) => Array.from(uuidToBytes(id), b => b.toString(16).padStart(2, "0")).join("");
+const lower = (id) => { uuidToBytes(id); return id.toLowerCase(); };
+function bounded(work, fallback, ms = SIGN_OUT_ERASE_TIMEOUT_MS) {
+    let timer;
+    return Promise.race([work.catch(() => fallback), new Promise(resolve => { timer = setTimeout(() => resolve(fallback), ms); })])
+        .finally(() => clearTimeout(timer));
+}
+/** True once deleted (or never existed). Every SDK store closes its own
+ * connection on `versionchange`, so a delete is only blocked by a connection
+ * that did not close (another tab of an older build): bounded, then false. */
+function deleteDatabase(name) {
+    return bounded(new Promise(resolve => {
+        const request = indexedDB.deleteDatabase(name);
+        request.onsuccess = () => resolve(true);
+        request.onerror = () => resolve(false);
+        // onblocked: keep waiting (the delete stays queued) until the bound.
+    }), false);
+}
+/** Exact database names for this scope, plus (where `indexedDB.databases()`
+ * exists) collection-scoped stores of the same installation whose collection
+ * is no longer listed, matched by the full account/connector/device/installation prefix. */
+/** installation-store database names: [current slot, unlabelled v1 slot]. */
+function ledgerNames(scope) {
+    const cp = encodeURIComponent(scope.cpOrigin), unlabelled = `mdbase.app.installation.v1.${cp}.${scope.appId}`;
+    return [scope.owner === undefined ? unlabelled : `mdbase.app.installation.v2.${cp}.${encodeURIComponent(scope.owner)}.${scope.appId}`, unlabelled];
+}
+async function otherDatabaseNames(scope, ledger, unlabelled) {
+    const others = new Set(scope.isolated ? [] : scope.databases);
+    if (!scope.isolated && scope.storageNamespace === undefined)
+        others.add(unlabelled); // an earlier unlabelled slot of this app (removed below when it is the current one)
+    const { accountId: account, connectorId: connector, deviceId: device, installationId: installation } = scope;
+    if (account && connector && device && installation) {
+        const keyIds = [account, connector, device, installation].map(hex).join(".");
+        others.add(`mdbase.app.device-key-kek.v1.${keyIds}`);
+        others.add(`mdbase.app.device-keys.v1.${keyIds}`);
+        others.add(`mdbase.app.noise.v1.${lower(installation)}.${lower(connector)}.${lower(device)}`);
+        const prefix = [account, connector, device, installation].map(lower).join(".");
+        const scoped = [`mdbase.app.cloud-copy-outcome.v1.${prefix}.`, `mdbase.app.private-bootstrap.v1.${prefix}.`];
+        for (const collection of scope.collectionIds) {
+            const id = lower(collection);
+            for (const purpose of ["create", "join"])
+                others.add(`${scoped[0]}${id}.${purpose}`);
+            for (const purpose of ["create", "enrol"])
+                others.add(`${scoped[1]}${id}.${purpose}`);
+        }
+        const list = indexedDB.databases;
+        if (typeof list === "function") {
+            const found = await bounded(list.call(indexedDB), []);
+            for (const { name } of found)
+                if (name && scoped.some(p => name.startsWith(p)))
+                    others.add(name);
+        }
+    }
+    others.delete(ledger);
+    return [...others];
+}
+/** OPFS replica pools `.mdbase-app-<account>-<installation>-<collection>`
+ * (app-storage `appPoolNames`). Their SQLite handles close with the native host. */
+async function removeReplicas(account, installation) {
+    const storage = globalThis.navigator?.storage;
+    if (typeof storage?.getDirectory !== "function")
+        return true; // no OPFS: nothing was stored there
+    return bounded((async () => {
+        const root = await storage.getDirectory();
+        const prefix = `.mdbase-app-${lower(account)}-${lower(installation)}-`, names = [];
+        for await (const name of root.keys())
+            if (name.startsWith(prefix))
+                names.push(name);
+        let ok = true;
+        for (const name of names) {
+            try {
+                await root.removeEntry(name, { recursive: true });
+            }
+            catch {
+                ok = false;
+            }
+        }
+        return ok;
+    })(), false);
+}
+/** Forget one retired hosted scope's replica keys/data and bootstrap outcomes.
+ * The original installation signing custody, other scopes, shared journals and
+ * token cache remain untouched. Call only after that scope's native/SQL stop. */
+export async function eraseAppCollectionAccess(scope, collectionId) {
+    try {
+        if (!globalThis.indexedDB || !scope.accountId || !scope.connectorId || !scope.deviceId || !scope.installationId)
+            return false;
+        const collection = lower(collectionId), prefix = [scope.accountId, scope.connectorId, scope.deviceId, scope.installationId].map(lower).join(".");
+        const names = ["create", "join"].map(purpose => `mdbase.app.cloud-copy-outcome.v1.${prefix}.${collection}.${purpose}`);
+        names.push(...["create", "enrol"].map(purpose => `mdbase.app.private-bootstrap.v1.${prefix}.${collection}.${purpose}`));
+        const results = await Promise.all(names.map(deleteDatabase));
+        const storage = globalThis.navigator?.storage;
+        if (typeof storage?.getDirectory === "function") {
+            const root = await storage.getDirectory();
+            try {
+                await root.removeEntry(`.mdbase-app-${lower(scope.accountId)}-${lower(scope.installationId)}-${collection}`, { recursive: true });
+            }
+            catch (error) {
+                if (!(error instanceof DOMException && error.name === "NotFoundError"))
+                    return false;
+            }
+        }
+        return results.every(Boolean);
+    }
+    catch {
+        return false;
+    }
+}
+/** Run only after every connection/handle of this installation was closed and
+ * the server sign-out was attempted. Never throws. */
+export async function eraseAppInstallationData(scope) {
+    if (!globalThis.indexedDB)
+        return Object.freeze({ ledger: false, complete: false });
+    const [current, unlabelled] = ledgerNames(scope);
+    // The ledger first: it alone decides whether a reload restores the session.
+    const ledger = await deleteDatabase(current);
+    let others = null;
+    try {
+        others = await otherDatabaseNames(scope, current, unlabelled);
+    }
+    catch { /* malformed scope: leftovers reported below */ }
+    // Preserve legacy default erasure. Namespace callers share the cache DB,
+    // so they remove only their CP/connector/device records below.
+    const results = others ? await Promise.all([...others, ...(scope.isolated || scope.storageNamespace !== undefined ? [] : [LOG_TOKEN_DATABASE])].map(deleteDatabase)) : [false];
+    const tokens = scope.storageNamespace === undefined ? true : await bounded(eraseAppLogTokens(scope), false);
+    const replicas = scope.accountId && scope.installationId ? await removeReplicas(scope.accountId, scope.installationId).catch(() => false) : true;
+    return Object.freeze({ ledger, complete: ledger && tokens && replicas && results.every(Boolean) });
+}
+//# sourceMappingURL=sign-out-erase.js.map

package/dist/app-host/sign-out-erase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out-erase.js","sourceRoot":"","sources":["../../src/app-host/sign-out-erase.ts"],"names":[],"mappings":"AAAA;;;6EAG6E;AAC7E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA6B1C;;kDAEkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvG,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5E,SAAS,OAAO,CAAI,IAAgB,EAAE,QAAW,EAAE,EAAE,GAAG,yBAAyB;IAC/E,IAAI,KAAgD,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAI,OAAO,CAAC,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/H,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;8EAE8E;AAC9E,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,OAAO,CAAC,IAAI,OAAO,CAAU,OAAO,CAAC,EAAE;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,qEAAqE;IACvE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACb,CAAC;AAED;;4FAE4F;AAC5F,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAA2B;IAC9C,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,8BAA8B,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9G,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,8BAA8B,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;AACrJ,CAAC;AACD,KAAK,UAAU,kBAAkB,CAAC,KAA2B,EAAE,MAAc,EAAE,UAAkB;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,oFAAoF;IACzK,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC7G,IAAI,OAAO,IAAI,SAAS,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,CAAC,oCAAoC,MAAM,GAAG,EAAE,mCAAmC,MAAM,GAAG,CAAC,CAAC;QAC7G,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7B,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;YACrF,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAI,SAAyE,CAAC,SAAS,CAAC;QAClG,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAkC,CAAC,CAAC;YACtF,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK;gBAAE,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAMD;oFACoF;AACpF,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,YAAoB;IACjE,MAAM,OAAO,GAAI,UAAU,CAAC,SAAiF,EAAE,OAAO,CAAC;IACvH,IAAI,OAAO,OAAO,EAAE,YAAY,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;IAClG,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAa,EAAmB,CAAC;QAC5D,MAAM,MAAM,GAAG,eAAe,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,GAAa,EAAE,CAAC;QAC7F,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,EAAE,GAAG,KAAK,CAAC;YAAC,CAAC;QAAC,CAAC;QAC9G,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACf,CAAC;AAED;;iFAEiF;AACjF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAA2B,EAAE,YAAoB;IAC9F,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc;YAAE,OAAO,KAAK,CAAC;QAC9H,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjJ,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,oCAAoC,MAAM,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC;QACvH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mCAAmC,MAAM,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;QACxH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAI,UAAU,CAAC,SAA6E,EAAE,OAAO,CAAC;QACnH,IAAI,OAAO,OAAO,EAAE,YAAY,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,EAAmB,CAAC;YAC3D,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,UAAU,EAAE,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;YAAC,CAAC;YACxI,OAAO,KAAK,EAAE,CAAC;gBAAA,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC;oBAAE,OAAO,KAAK,CAAC;YAAA,CAAC;QACvG,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;AACzB,CAAC;AAED;sDACsD;AACtD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAA2B;IACxE,IAAI,CAAC,UAAU,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAoB,IAAI,CAAC;IACnC,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;IAChI,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/K,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,IAAI,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACrG,CAAC"}

package/dist/app-host/status.d.ts

@@ -0,0 +1,62 @@
+/** First-party app-host status. Local persistence is not a log acknowledgement. */
+import type { SyncStatus } from "../wire.js";
+export interface AppStoragePolicy {
+    /** True only after navigator.storage.persisted()/persist() returned true. */
+    persistent: boolean;
+    /** PWA standalone (including iOS standalone) or an installed native app. */
+    installed: boolean;
+}
+export type AppSaveState = {
+    kind: "no_pending_edits";
+    unsynced: 0;
+    warning: null;
+} | {
+    kind: "not_yet_synced";
+    unsynced: number;
+    warning: "storage_may_be_evicted" | null;
+};
+/** `unsynced` comes from the recovered replica's pending count, never a transport
+ * heuristic. Zero pending is NOT proof that an individual mutation was saved:
+ * rejected/unknown receipts remain separate, explicit outcomes. Normal online
+ * edits and brief connecting states get a 30-second grace period; genuinely
+ * offline pending edits warn immediately. Persistence suppresses the warning.
+ * `pendingForMs` is the continuous nonzero-pending age, reset at zero/scope change. */
+export declare function appSaveState(unsynced: number, policy: AppStoragePolicy, context?: {
+    pendingForMs: number;
+    connection: SyncStatus["connection"];
+}): AppSaveState;
+/** Only a log-confirmed receipt may produce the user-facing "saved" state. */
+export declare function appMutationSaveState(receiptState: "pending" | "confirmed" | "rejected" | "unknown"): "not_yet_synced" | "saved" | "rejected" | "outcome_unknown";
+export declare const UNSYNCED_STORAGE_WARNING = "Some changes are only on this device. Stay online so they can sync.";
+/** Host progress is not a new replica-client wire slot. */
+export type AppReplicaReadiness = {
+    phase: "opening" | "waiting_for_key";
+    readable: false;
+    writable: false;
+} | {
+    phase: "installing";
+    readable: boolean;
+    writable: false;
+    complete: false;
+    installed: number;
+    total: number | null;
+} | {
+    phase: "ready";
+    readable: true;
+    writable: boolean;
+    complete: true;
+    stale: boolean;
+} | {
+    phase: "blocked";
+    readable: boolean;
+    writable: false;
+    reason: "storage" | "integrity" | "upgrade_required" | "authorization";
+};
+/** Small injected navigator surface: no Capacitor dependency and no Worker→UI RPC. */
+export interface PersistencePort {
+    persisted(): Promise<boolean>;
+    persist?(): Promise<boolean>;
+}
+/** Asking for persistence is explicit; a denied/unsupported/error result is false,
+ * never permission to reset the database. Installation status is supplied by UI. */
+export declare function appStoragePolicy(storage: PersistencePort | undefined, installed: boolean, requestPersistence?: boolean): Promise<AppStoragePolicy>;

package/dist/app-host/status.js

@@ -0,0 +1,43 @@
+/** `unsynced` comes from the recovered replica's pending count, never a transport
+ * heuristic. Zero pending is NOT proof that an individual mutation was saved:
+ * rejected/unknown receipts remain separate, explicit outcomes. Normal online
+ * edits and brief connecting states get a 30-second grace period; genuinely
+ * offline pending edits warn immediately. Persistence suppresses the warning.
+ * `pendingForMs` is the continuous nonzero-pending age, reset at zero/scope change. */
+export function appSaveState(unsynced, policy, context = { pendingForMs: 0, connection: "online" }) {
+    if (!Number.isSafeInteger(unsynced) || unsynced < 0)
+        throw new RangeError("invalid unsynced count");
+    if (unsynced === 0)
+        return { kind: "no_pending_edits", unsynced: 0, warning: null };
+    return {
+        kind: "not_yet_synced",
+        unsynced,
+        warning: !policy.persistent && (context.pendingForMs >= 30_000 || context.connection === "offline") ? "storage_may_be_evicted" : null,
+    };
+}
+/** Only a log-confirmed receipt may produce the user-facing "saved" state. */
+export function appMutationSaveState(receiptState) {
+    switch (receiptState) {
+        case "pending": return "not_yet_synced";
+        case "confirmed": return "saved";
+        case "rejected": return "rejected";
+        case "unknown": return "outcome_unknown";
+        default: throw new RangeError("invalid receipt state");
+    }
+}
+export const UNSYNCED_STORAGE_WARNING = "Some changes are only on this device. Stay online so they can sync.";
+/** Asking for persistence is explicit; a denied/unsupported/error result is false,
+ * never permission to reset the database. Installation status is supplied by UI. */
+export async function appStoragePolicy(storage, installed, requestPersistence = false) {
+    let persistent = false;
+    try {
+        persistent = (await storage?.persisted()) === true;
+        if (!persistent && requestPersistence)
+            persistent = (await storage?.persist?.()) === true;
+    }
+    catch {
+        // Preserve a verified positive result; otherwise report the conservative state.
+    }
+    return { persistent, installed };
+}
+//# sourceMappingURL=status.js.map

package/dist/app-host/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/app-host/status.ts"],"names":[],"mappings":"AAaA;;;;;uFAKuF;AACvF,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,MAAwB,EACxB,UAA0E,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE;IAEnH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;IACpG,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ;QACR,OAAO,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;KACtI,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAClC,YAA8D;IAE9D,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC,CAAC,OAAO,gBAAgB,CAAC;QACxC,KAAK,WAAW,CAAC,CAAC,OAAO,OAAO,CAAC;QACjC,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,SAAS,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACzC,OAAO,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GACnC,qEAAqE,CAAC;AAexE;oFACoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoC,EACpC,SAAkB,EAClB,kBAAkB,GAAG,KAAK;IAE1B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,MAAM,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,IAAI,CAAC;QACnD,IAAI,CAAC,UAAU,IAAI,kBAAkB;YAAE,UAAU,GAAG,CAAC,MAAM,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC"}

package/dist/app-host/storage-probe.d.ts

@@ -0,0 +1,46 @@
+/** OPFS capability probe, NOT SQLite/physical-durability qualification.
+ * Run in the dedicated Worker which will also own runtime.wasm and sqlite-wasm.
+ * It touches only a random scratch file under the reserved probe directory. */
+export interface ProbeSyncHandle {
+    write(bytes: Uint8Array, options: {
+        at: number;
+    }): number;
+    read(bytes: Uint8Array, options: {
+        at: number;
+    }): number;
+    flush(): void;
+    close(): void;
+}
+export interface ProbeDirectory {
+    getDirectoryHandle(name: string, options: {
+        create: true;
+    }): Promise<ProbeDirectory>;
+    getFileHandle(name: string, options: {
+        create: true;
+    }): Promise<{
+        createSyncAccessHandle?(): Promise<ProbeSyncHandle>;
+    }>;
+    removeEntry(name: string): Promise<void>;
+}
+export interface AppStorageProbeEnvironment {
+    /** Must be established by the trusted host, not an application grant. */
+    worker: boolean;
+    storage?: {
+        getDirectory?(): Promise<ProbeDirectory>;
+    };
+    /** CSPRNG-generated UUID supplied by the host (crypto.randomUUID). */
+    randomUUID(): string;
+}
+export type AppStorageProbe = {
+    supported: true;
+    backend: "opfs_sahpool_candidate";
+    crashDurability: "unqualified";
+    eviction: "possible";
+} | {
+    supported: false;
+    reason: "worker_required" | "opfs_unavailable" | "sync_handle_unavailable" | "probe_failed" | "cleanup_failed";
+};
+/** Success proves only that synchronous access/flush/readback are available now.
+ * It does not open an app store, return IndexDurability::Durable or certify saved
+ * edits. Errors deliberately omit browser exception messages/storage paths. */
+export declare function probeAppStorage(env: AppStorageProbeEnvironment): Promise<AppStorageProbe>;

package/dist/app-host/storage-probe.js

@@ -0,0 +1,63 @@
+/** Success proves only that synchronous access/flush/readback are available now.
+ * It does not open an app store, return IndexDurability::Durable or certify saved
+ * edits. Errors deliberately omit browser exception messages/storage paths. */
+export async function probeAppStorage(env) {
+    if (!env.worker)
+        return { supported: false, reason: "worker_required" };
+    if (!env.storage?.getDirectory)
+        return { supported: false, reason: "opfs_unavailable" };
+    let directory;
+    let file;
+    let created = false;
+    let handle;
+    let result = { supported: false, reason: "probe_failed" };
+    try {
+        const id = env.randomUUID();
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) {
+            return result;
+        }
+        file = id.toLowerCase();
+        directory = await (await env.storage.getDirectory()).getDirectoryHandle(".mdbase-app-probes", { create: true });
+        const entry = await directory.getFileHandle(file, { create: true });
+        created = true;
+        if (!entry.createSyncAccessHandle) {
+            result = { supported: false, reason: "sync_handle_unavailable" };
+        }
+        else {
+            handle = await entry.createSyncAccessHandle();
+            const bytes = new Uint8Array([0x6d, 0x64, 0x62, 0x6e]);
+            const read = new Uint8Array(bytes.length);
+            if (handle.write(bytes, { at: 0 }) !== bytes.length)
+                throw new Error("short probe write");
+            handle.flush();
+            if (handle.read(read, { at: 0 }) !== bytes.length || read.some((b, i) => b !== bytes[i])) {
+                throw new Error("probe readback failed");
+            }
+            result = { supported: true, backend: "opfs_sahpool_candidate", crashDurability: "unqualified", eviction: "possible" };
+        }
+    }
+    catch {
+        result = { supported: false, reason: "probe_failed" };
+    }
+    finally {
+        let closed = true;
+        try {
+            handle?.close();
+        }
+        catch {
+            closed = false;
+            result = { supported: false, reason: "cleanup_failed" };
+        }
+        // Do not remove an entry while its close outcome is uncertain.
+        if (created && closed && directory && file) {
+            try {
+                await directory.removeEntry(file);
+            }
+            catch {
+                result = { supported: false, reason: "cleanup_failed" };
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=storage-probe.js.map

package/dist/app-host/storage-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-probe.js","sourceRoot":"","sources":["../../src/app-host/storage-probe.ts"],"names":[],"mappings":"AA2BA;;+EAE+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAA+B;IACnE,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxF,IAAI,SAAqC,CAAC;IAC1C,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAmC,CAAC;IACxC,IAAI,MAAM,GAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAChF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACxB,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,kBAAkB,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;YAClC,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC1F,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC1D,CAAC;QACD,+DAA+D;QAC/D,IAAI,OAAO,IAAI,MAAM,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/app-host/timer-port.d.ts

@@ -0,0 +1,29 @@
+import type { AppTimersPort } from "../timers.js";
+import type { AppReplicaScope } from "./owner.js";
+import type { AppInstallationTimerChannel } from "./installation-sign-in.js";
+/** Internal trusted-host composition. The host selects the ORIGINAL receipt;
+ * public grant IDs supplied by a caller never select this receiver's authority. */
+export declare function attachAppTimerReceiver(port: MessagePort, options: {
+    scope: Readonly<AppReplicaScope>;
+    generation: string;
+    grantId: string;
+    cpOrigin: string;
+    signal: AbortSignal;
+    isCurrent(): boolean;
+    bearer(): Promise<string>;
+    fetch: typeof fetch;
+    journal?: {
+        read(): AppInstallationTimerChannel | null;
+        write(value: AppInstallationTimerChannel | null): Promise<void>;
+    };
+}): {
+    close(): Promise<void>;
+};
+/** UI fixed timer proxy, not another MdbaseClient or replica facade. */
+export declare function appTimerPortClient(port: MessagePort, binding: {
+    scope: Readonly<AppReplicaScope>;
+    generation: string;
+}, options: {
+    signal: AbortSignal;
+    onClose(): void;
+}): AppTimersPort;